3059 matches found
CyberVision Kaa IoT Platform Remote Code Injection Vulnerability
CyberVision Kaa IoT Platform is a multi-purpose middleware platform for IoT from CyberVision USA that enables building complete end-to-end IoT solutions. The CyberVision Kaa IoT Platform suffers from a remote code injection vulnerability. An attacker can exploit this vulnerability to inject and...
CVE-2016-7841
Cross-site scripting vulnerability in Olive Diary DX allows remote attackers to inject arbitrary web script or HTML via the page parameter...
CVE-2017-7897
A cross-site scripting XSS vulnerability in the MantisBT 2.3.x before 2.3.2 Timeline include page, used in My View myviewpage.php and User Information viewuserpage.php pages, allows remote attackers to inject arbitrary code if CSP settings permit it through crafted PATHINFO in a URL, due to use o...
CVE-2017-7897
Summary: CVE-2017-7897 is an XSS vulnerability in MantisBT 2.3.x before 2.3.2, triggered via crafted PATH_INFO in URLs on the Timeline include page used by My View (my_view_page.php) and User Information (view_user_page.php). The root cause is unsanitized $_SERVER['PHP_SELF'] used to generate URL...
CVE-2016-4875
CVE-2016-4875 describes cross-site scripting (CWE-79) vulnerabilities in Geeklog IVYWE edition plugins: Assist (before 1.1.2.test20160906), dataBox (before 0.0.0.20160906), and userBox (before 0.0.0.20160906). The root cause is untrusted input that can be injected into administrator-facing contex...
Asterisk CDR Buffer Overflow Vulnerability (AST-2017-001)
Asterisk is prone to a buffer overflow vulnerability in CDR SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:digium:asterisk"; if...
Cross site scripting
A cross-site scripting XSS vulnerability in the MantisBT Configuration Report page admconfigreport.php allows remote attackers to inject arbitrary code if CSP settings permit it through a crafted 'configoption' parameter. This is fixed in 1.3.9, 2.1.3, and 2.2.3...
CVE-2017-7241
A cross-site scripting XSS vulnerability in the MantisBT Move Attachments page moveattachmentspage.php, part of admin tools allows remote attackers to inject arbitrary code through a crafted 'type' parameter, if Content Security Protection CSP settings allows it. This is fixed in 1.3.9, 2.1.3, an...
CVE-2017-6973
CVE-2017-6973 relates to a cross-site scripting (XSS) vulnerability in MantisBT on the Configuration Report page (adm_config_report.php). The issue arises from insufficient sanitization of the crafted action parameter, allowing remote attackers to inject arbitrary code. The vulnerability is fixed...
CVE-2017-7309
CVE-2017-7309 describes a cross-site scripting (XSS) vulnerability in MantisBT’s adm_config_report.php (Configuration Report) where the config_option parameter can be crafted to inject code. Affected software is MantisBT; the vulnerability arises from insufficient input validation on the configur...
MediaWiki Multiple Vulnerabilities (Mar 2015) - Windows
MediaWiki is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mediawiki:mediawiki"; ifdescripti...
asterisk -- Buffer overflow in CDR's set user
The Asterisk project reports: No size checking is done when setting the user field on a CDR. Thus, it is possible for someone to use an arbitrarily large string and write past the end of the user field storage buffer. This allows the possibility of remote code injection...
CVE-2015-8622
Cross-site scripting XSS vulnerability in MediaWiki before 1.23.12, 1.24.x before 1.24.5, 1.25.x before 1.25.4, and 1.26.x before 1.26.1, when is configured with a relative URL, allows remote authenticated users to inject arbitrary web script or HTML via wikitext, as demonstrated by a wikilink to...
The vulnerability of the McAfee VirusScan Enterprise anti-virus software allows a intruder to inject arbitrary Web or HTML code.
The vulnerability of the McAfee VirusScan Enterprise antivirus software exists due to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to inject arbitrary Web or HTML code remotely...
Apache NiFi Remote Code Injection Vulnerability
Apache NiFi is an automated solution for data transfer between systems. Apache NiFi suffers from a remote code injection vulnerability. An attacker can exploit this vulnerability to execute arbitrary code in the context of a user running in an affected application, with a failed attack resulting ...
CVE-2016-7103
Cross-site scripting XSS vulnerability in jQuery UI before 1.12.0 might allow remote attackers to inject arbitrary web script or HTML via the closeText parameter of the dialog function...
Code injection
Zyxel USG50 Security Appliance and NWA3560-N Access Point allow remote attackers to cause a denial of service CPU consumption via a flood of ICMPv4 Port Unreachable packets...
CVE-2017-5010
Removed by vendor...
CVE-2017-5006
Blink in Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87 for Android, incorrectly handled object owner relationships, which allowed a remote attacker to inject arbitrary scripts or HTML UXSS via a crafted HTML page...